Splunk Search

## How to use delta command to calculate change of current value from previous value to not produce negative results?

Communicator

When use the `delta` command I get results like this

``````Value  delta(Value)   what-I-want-it-to-be
1        0                   /
1        -1                  0
2        -3                  1
5        -4                  3
9        /                   4
``````

Here, delta(n) is value(n)-value(n+1).. that is to say it is calculating the difference of the next value, not the previous.

I want it to be delta(n) = value(n)-value(n-1).

This is normally what I think of when someone says "delta"... the change since the last value, not the change that is about to happen.

Am I using delta wrong? Is there away to use it to calculate past change, not future change?

``````eventype=myevents | delta Value | sort + _time
``````

Returns positive values looking back

``````eventype=myevents | sort + _time | delta Value
``````
Tags (1)
1 Solution
Contributor

I don't have an instance of Splunk to test on at the moment, but can you sort the data so its order is reversed prior to the delta command?

Retired

Hi @neiljpeterson

Both previous comments on this question are now answers so you can accept whichever one helped solve your issue 🙂 Glad you found what you needed on Splunk Answers!

Patrick

Contributor

I don't have an instance of Splunk to test on at the moment, but can you sort the data so its order is reversed prior to the delta command?

Communicator

:facepalm: Duh! Brain is not working today. That does the trick. Please post this as an answer so I can accept it! Thanks!

Retired

Hi @neiljpeterson

Would you be able to paste the search query you're using? It'll help folks with giving you an exact answer and also help people with the same problem. A similar question was asked before. Check this out to see if the solution can solve your problem as well. http://answers.splunk.com/answers/152960/how-to-edit-search-so-delta-command-does-not-return-negativ...

Get Updates on the Splunk Community!

#### Take the 2021 Splunk Career Survey for \$50 in Amazon Cash

Help us learn about how Splunk has impacted your career by taking the 2021 Splunk Career Survey. Last year’s ...

#### Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

#### Observability Newsletter Highlights | March 2023

March 2023 | Check out the latest and greatestSplunk APM's New Tag Filter ExperienceSplunk APM has updated ...